INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers Use New Infostealer Malware to Steal ChatGPT Tokens

| 2026-11-04 08:55 LOW MEDIUM AI-ENABLED ATTACK DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
Hackers are expanding information theft beyond saved passwords, targeting authentication tokens and session data stored by ChatGPT, Claude, Codex, and other AI tools. Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured. The danger extends beyond […] The post Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets appeared first on Cyber Security News .
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables 22 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 22 IoCs Create Free Account
sha1 15 domains 6 urls 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎2026/11/04
Threat actors used the newly observed Windows infostealer Aokigahara to target login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor.
infrastructure Cursor
A newly observed Windows infostealer called Aokigahara is targeting login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor.
New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials.
The threat is not evidence that these AI […] The post New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials appeared first on Cyber Security News .
infrastructure Windows
Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured.
A newly observed Windows infostealer called Aokigahara is targeting login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor.
organisation WardenStealer
Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured.
organisation Aoki
Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured.
organisation ChatGPT Desktop
A newly observed Windows infostealer called Aokigahara is targeting login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor.
organisation Steal
Hackers Use New Infostealer Malware to Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets.
organisation New Aokigahara
New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials.
organisation Cyber Security News
The threat is not evidence that these AI […] The post New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials appeared first on Cyber Security News .
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Two Windows malware families, WardenStealer and Aoki, collect credentials that may remain usable after a password reset, leaving victims exposed even after they believe their accounts are secured.
A newly observed Windows infostealer called Aokigahara is targeting login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor.
Metrics
infrastructure
‎Cursor
Affected Product
New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials.
A newly observed Windows infostealer called Aokigahara is targeting login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor.
The threat is not evidence that these AI […] The post New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials appeared first on Cyber Security News .
Intelligence Sources
AlienVault OTX 2026-10-27
AlienVault OTX 2026-11-04